Vulnerability · Published Apr 22, 2026 · Assigned by canonical
CVE-2026-35369uutils coreutils kill System-wide Process Termination and Denial of Service via Argument Misinterpretation
Medium 5.5
In plain English
A medium-severity improper input validation in coreutils from Uutils. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35369 |
| Debian:13 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35369 |
| Debian:14 | rust-coreutils | 0.6.0-1 | DEBIAN-CVE-2026-35369 |
| Ubuntu:24.04:LTS | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35369 |
| Ubuntu:25.10 | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35369 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/uutils/coreutils/pull/9700 issue-tracking, patch
- https://github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory